- cypherpunks-legacy - lists.cpunks.org

Re: Did you *really* zeroize that key?
by Matt Blaze 07 Nov '02

07 Nov '02

> At 03:55 PM 11/7/02 +0100, Steven M. Bellovin wrote: > >Regardless of whether one uses "volatile" or a pragma, the basic point > >remains: cryptographic application writers have to be aware of what a > >clever compiler can do, so that they know to take countermeasures. > > Wouldn't a crypto coder be using paranoid-programming > skills, like *checking* that the memory is actually zeroed? > (Ie, read it back..) I suppose that caching could still > deceive you though?' And, of course, the very act of putting in the check could cause a compiler to not optimize out the zeroize code. (Writing a proper test program for such behavior is very difficult). Like most programming language discussions, it's hard to tell whether the arguments support writing critical code languages that abstract at a higher level or a lower level. > > I've read about some Olde Time programmers > who, given flaky hardware (or maybe software), > would do this in non-crypto but very important apps. > > > > > > > > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: "patent free(?) anonymous credential system pre-print" - a simpleattack and other problems
by Stefan Brands 07 Nov '02

07 Nov '02

Hello Jason: >"Page 193 and 210 do talk about having an identifying >value encoded in the credentials which the holder can >prove is or isn't the same as in other credentials. However, >the discussion on page 193 is with respect to building >digital pseudonyms" No, not at all. The paragraph on page 193 that I referred to is the one starting with "In some PKIs it is desirable that certificate holders can anonymously prove to be the originator of several showing protocol executions." It _preceeds_ the paragraph on digital pseudonyms, which starts with "A special application of the latter technique are credential systems in which certificate holders [...] establish digital pseudonyms with organizations". >I can think of ways in which this feature might be leveraged to >create otherwise-unlinkable sets of credentials from different >(distrusting) CAs, but it's never addressed directly that I can >see, and would need some specifics filled in." There are no specifics to be filled in, the paragraph on 193 states everything there is to it. If the credential holder engages in several showing protocols (whether in sequence or in parallel, and regardless of whether at the same time or at different times -- the paragraph applies to any situation), all that is needed to prove that no pooling is going on is the abovementioned proof that the credentials all contain the same hidden identifier. Note that the prover can _hide_ this identifier, thereby allowing him to prevent linkability with other showing protocol executions for which no link needs to be established. Of course, the technique also works if there are many Cas. The user can even prevent the CAs from learning the built-in identifier that is central to all (or a subset of) his/her credentials. (A special CA could issue restrictively blindeded versions of the user's "identity", which the user then submits to different Cas who encode it into the certificates they issue.) >Page 211 of your book talks about discouraging lending, which doesn't >help in the case when Bob answers in Alice's behalf when she shows his >credentials. Discouraging lending is not the same as preventing pooling. The lending prevention technique was not intended to address pooling, the technique on page 193 does a much more effective job at that. However, in your approach, what prevents me from giving my credentials to someone else who then uses them to gain access to a service without needing to pool in any other credentials than the one I lent to him? Note also that when all credential attributes are specified within the same certificate, and the verifier requires authorization information to be contained within a single attribute certificate, pooling is inherently prevented. >What do you mean by "forced to leave behind digital signatures"? There is no zero-knowledge variant of your protocol; the verifier ends up with undisputable evidence (towards third parties) of the transaction, and in particular of which attribute values have been shown by the credential holder. Any digital signatures that are made by certificate holders can be added to their dossiers; they form self-signed statements that cannot be repudiated, proving to the whole world who is the originator of a message and possibly what information they were willing to give up in return for a service. Doing a zeroknowledge variant of your proposal requires one to prove knowledge in zk of various elements rather than showing them in the clear; this requires extrmely inefficient zk techniques, such as for proving knowledge of a pre-image under a specific hash function. >I'll expand my related work section to point out that your system and >others have lots of features which my system doesn't attempt to provide. >My apologies if my terse treatment mischaracterized your work. I realize that many of the features of my work are described in a very dense manner in the book, and therefore it is easy to overlook them. For example, on the same page 193 there is a sentence "Using our techniques it is also straightforward for several certificate holders to jointly demonstrate that their showing protocol executions did not all originate from the same certificate holder, or for one certificate holder to show that he or she was not involved in a fraudulent transaction." The same applies to my describtion of the simple hash selective disclosure technique on page 27, which only gets two sentences, and many others techniques/functionalities. The only excuse I have for this is that the book is a minor revision of my PhD thesis, and so the technical parts had to be targetted towards an expert audience; while skilled cryptographers will indeed find the dense statements more than sufficient, and may even consider some of them as trivial applications of the general techniques, I can see that this may not always be the case for readers in general. Good luck with your research! Stefan Brands --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Did you *really* zeroize that key?
by Steven M. Bellovin 07 Nov '02

07 Nov '02

In message <200211070207.PAA88426(a)ruru.cs.auckland.ac.nz>, Peter Gutmann writes : >>[Moderator's note: FYI: no "pragma" is needed. This is what C's "volatile" >> keyword is for. > >No it isn't. This was done to death on vuln-dev, see the list archives for >the discussion. > >[Moderator's note: I'd be curious to hear a summary -- it appears to >work fine on the compilers I've tested. --Perry] > Regardless of whether one uses "volatile" or a pragma, the basic point remains: cryptographic application writers have to be aware of what a clever compiler can do, so that they know to take countermeasures. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

2 1

RE: New Protection for 802.11
by Trei, Peter 07 Nov '02

07 Nov '02

> James A. Donald[SMTP:jamesd@echeque.com] wrote: > > > Reading the Wifi report, > http://www.weca.net/OpenSection/pdf/Wi- > Fi_Protected_Access_Overview.pdf > it seems their customers stampeded them and demanded that the > security hole be fixed, fixed a damned lot sooner than they > intended to fix it. > > I am struck the contrast between the seemingly strong demand > for wifi security, compared to the almost complete absence of > demand for email security. > > Why is it so? > > --digsig > James A. Donald > How many stories have you read in the last year about non-LEOs stealing email? How many stories in the last year have you read about wardriving? Further, tapping into 802.11b nets * gives the attacker access to your internal network. You already know what you're sending in email, and eavesdropping on data you've already decided to send to someone else feels different than someone trolling through your file system without your knowledge. * requires that the tapper be more or less nearby physically. This feels a lot different than worrying that a distant router is compromised. Peter Trei --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: New Protection for 802.11
by James A. Donald 07 Nov '02

07 Nov '02

-- Reading the Wifi report, http://www.weca.net/OpenSection/pdf/Wi- Fi_Protected_Access_Overview.pdf it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it. I am struck the contrast between the seemingly strong demand for wifi security, compared to the almost complete absence of demand for email security. Why is it so? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG IWe4JFeDeor04Pxb96ZsQ7xX+JAwxSs8HQfoAeG5 4rQX6tgLhAvAwLjF+SXlRswSmphBhw4cOXLe9Y4r5 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

New Scott shows how to globalize your business.
by Scott K 07 Nov '02

07 Nov '02

Hi cypherpunks(a)Algebra.COM, Have you known it yet? A perfect globalization tool for your business. It's the best marketing tool that save your time, money and increase your revenue! http://www.thcity.com/importerlist/directory.html - Every worry how to sell the products to other countries? - Finding the customers in a specified industry from around the world? - Searching the potential customers in a country? - Expanding your business in other regions of the world? ***** NOW YOU CAN MAKE IT EASILY! with the World Importer Directory ***** A bulk of interesting world importer directories are here http://www.thcity.com/importerlist/directory.html Over 152,000 importers from around the world are here. They are from 6 regions, over 150 countries, assembling in a single file for each directory. To meet your need as much as possible, they are designed and classified by country, region and industry. The data contain company name, e-mail, URL, contact address, contact person, telephone number, fax number, product imports. The World Importer Directories are available in 4 file formats, i.e. Application (.exe), MS Excel (.xls), Acrobat Reader (.pdf) and Text (.txt). You can choose upon your preference. http://www.thcity.com/importerlist/directory.html BEST SELLER!!! ************ Email of Importer Directory contains 11,900 email records. Interested? CLICK HERE to buy it. Don't be delay, the gold opportunity is on your hand right now! http://www.thcity.com/importerlist/directory.html Your sincerely, Scott Kayler

1 0

****Business Proposal****
by jmusa4＠myself.com 07 Nov '02

07 Nov '02

NATIONAL ELECTRIC POWER AUTHORITY NIGERIAN WATER WAYS APAPA, LAGOS.NIGERIA CELL PHONE:234-804-213-8559 REPLY TO: jmusa(a)myself.com DEAR FRIEND, YOUR COMPANY'S NAME AND ADDRESS WAS GOTTEN FROM A BUSINESS DIRECTORY IN MY SEARCH FOR A WELL KNOWN BUSINESSMAN WHO HAS NO QUESTIONABLE CHARACTER AND MUST BE A SUCCESSFUL BUSINESSMAN. AS A MATTER OF FACT, I AM JUSTICE MUSA , A DIRECTOR IN THE NATIONAL ELECTRIC POWER AUTHORITY (N.E.P.A). ALSO I WAS PRIVILEGED TO BE A MEMBER OF TENDER'S BOARD THAT AWARDED AND SUPERVISED THE EXECUTION OF A MULTIMILLION U.S. DOLLARS CONTRACT IN 1998. THE CONTRACT HAS BEEN COMPLETED AND COMMISSIONED IN AUGUST 1996,AND ORIGINAL CONTRACT VALUE PAID IN OCTOBER 2000, TO THE FOREIGN FIRM THAT ACTUALLY EXECUTED THE CONTRACT. HOWEVER, AS A RESULT OF OVER-INVOICING AND SERIES OF REVISION CARRIED OUT IN THE COURSE OF THE CONTRACT EXECUTION, THERE NOW EXISTS A FLOATING SUM OF US$45.5M(FORTY FIVE MILLION FIVE HUNDRED THOUSAND U.S DOLLARS ONLY). THIS MONEY IS NOW DUE FOR PAYMENT IN THE GOVERNMENT QUARTERLY PAYMENT SCHEDULE AND WE WISH TO REMIT THIS FUND INTO YOUR DESIGNATED PERSONAL OR CORPORATE ACCOUNTS OVERSEAS. WE SHALL SECURE THE PAYMENT APPROVALS FROM THE RELEVANT OFFICE/MINISTRIES HERE FOR THE RELEASE OF THIS CONTRACT SUM IN FAVOUR OF YOUR COMPANY WITH DOCUMENT AND INFORMATION WE SHALL REQUEST FROM YOU TOO, WE HAVE NOW CONCLUDED ARRANGEMENTS IN THE CENTRAL BANK OF NIGERIA TO REMIT THIS MONEY AS SUM REALIZED BY A COMPANY THROUGH LEGITIMATE MEANS IN NIGERIA. TERMS AND CONDITIONS THE FUND WILL BE SHARED 35% FOR YOU AND 60% FOR US. THE REMAINING 5% TAKES CARE OF ALL INCIDENTAL EXPENSES. TO FORMALISE THIS TRANSACTION IN NIGERIA IN FAVOUR OF YOUR DESIGNATED COMPANY WE REQUIRE YOUTOFORWARD THE FOLLOWING: 1. AN ASSURANCE OF YOUR ABILITY, WILLINGNESS AND READINESS TO FULLY CORPORATE WITH US DURING DISBURSEMENT OVERSEAS AND TO MAINTAIN THE MAXIMUM CONFIDENTIALITY REQUIRED IN A BUSINESS OF THIS NATURE IN ALL PLACES AT ALL TIMES ON BOTH SIDES. 2. PARTICULARS OF YOUR BANKS INCLUDING NAME OF BANK, ADDRESS, ACCOUNT NUMBERS, TELEX AND FAX NUMBERSANDE-MAIL NUMBER OF YOUR BANK. 3.YOUR PRIVATE TELEX, FAX AND TELEPHONE NUMBERS FOR SAFE, QUICK AND EFFECTIVE COMMUNICATION INCLUDING HOME AND MOBILE PHONES (IF ANY). 4.WILLINGNESS & READINESS TO ASSIST ME IN PROCURING RELEVANT DOCUMENTS/APPROVALS. THIS REMITTANCE IS GUARANTEE IN LESS THAN 14(FOURTEEN) WORKING DAYS UPON RECEIPT OF THE ABOVE MENTION PARTICULARS BY FAX, HOWEVER, IT REQUIRES THE HIGHEST CO-OPERATION, SERIOUSNESS, MUTUAL TRUST, HONEST AND STRICTLY CONFIDENTIAL ON BOTH SIDES TO AVOID JEOPARDIZING THE POSITION OF THE OFFICERS WHO ARE TOP GOVERNMENT FUNCTIONARIES. ALSO WE WANT TO USE PART OF OUR PERCENTAGE TO IMPORT ANY QUICK SELLING GOODS WITH YOUR ASSISTANCE AFTER THE FUND HAS BEENTRANSFERREDINTO YOUR BANK ACCOUNT. LOOKING FORWARD TO HEARING FROM YOU THROUGH MY TELEPHONE:234-804-213-8559 OR REPLY TO: jmusa(a)myself.com BEST REGARD. JUSTICE MUSA

1 0

Re: Did you *really* zeroize that key?
by pgut001＠cs.auckland.ac.nz 06 Nov '02

06 Nov '02

>[Moderator's note: FYI: no "pragma" is needed. This is what C's "volatile" > keyword is for. No it isn't. This was done to death on vuln-dev, see the list archives for the discussion. [Moderator's note: I'd be curious to hear a summary -- it appears to work fine on the compilers I've tested. --Perry] Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Amsterdam loses electricity, lots of internet service
by Harmon Seaver 06 Nov '02

06 Nov '02

On Wed, Nov 06, 2002 at 04:02:54PM -0800, Bill Stewart wrote: > Reported on the NANOG list > > There's been an explosion in a power distribution center in amsterdam, > over > > half the city is without power, and, as far as I know, the Nikhef building > > is competely powerless, Telecity is running on backup generators. Redbus > > building seems at least partially up, but the link between Telecity and > > Redbut is dead. Power company is working on the problem, but as yet, its a > > big mess. > > --- > >> http://www.ams-ix.com/hugegraph.html > >> That can only be an error, I heard ams-ix got a power outage at the > moment... > > > 80% of Amsterdam is without power, one AMS-IX site is without no-break > > power for an other few weeks, others are running out of UPS capacity. Shit! Holy Shit! What will happen to all those grow rooms? This is an unparalled disaster. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com "War is just a racket ... something that is not what it seems to the majority of people. Only a small group knows what its about. It is conducted for the benefit of the very few at the expense of the masses." --- Major General Smedley Butler, 1933 "Our overriding purpose, from the beginning through to the present day, has been world domination - that is, to build and maintain the capacity to coerce everybody else on the planet: nonviolently, if possible, and violently, if necessary. But the purpose of US foreign policy of domination is not just to make the rest of the world jump through hoops; the purpose is to faciliate our exploitation of resources." - Ramsey Clark, former US Attorney General http://www.thesunmagazine.org/bully.html

1 0

Re: Did you *really* zeroize that key?
by Shawn K. Quinn 06 Nov '02

06 Nov '02

On Wednesday November 6 2002 10:22, Trei, Peter wrote: > What it really needs is the addition of a #pragma > dont_remove_this_code_you_bastard in the compiler. > Until then, a lot of security code will be affected by this problem. Somehow I don't think they'll quite call it this. But you've got to admit it is cute. :-) How about either: #pragma no_optimize or #pragma security -- Shawn K. Quinn

1 0